PT-2025-49214

The CoSign Single Signon plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $ SERVER'PHP SELF' parameter in all versions up to, and including, 0.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

WordPress plugin Hide Categories Or Products On Shop Page 跨站请求伪造漏洞

...

PT-2025-49208

The Image Optimizer by wps.sk plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.0. This is due to missing or incorrect nonce validation on the imagopby ajax optimize gallery function. This makes it possible for unauthenticated attackers to...

PT-2025-49235

Name of the Vulnerable Software and Affected Versions User Generator and Importer plugin for WordPress versions up to and including 1.2.2 Description The plugin is susceptible to Cross-Site Request Forgery due to missing nonce validation in the "Import Using CSV File" function. This allows...

Fanvil x210 安全漏洞

The Fanvil x210 is an IP telephony device from Fanvil. A security vulnerability exists in Fanvil x210 V2 version 2.12.20, which originates from a directory traversal, and could allow an unauthenticated attacker on the local network to store files to an arbitrary location...

CVE-2025-11838

CVE-2025-11838 involves a memory corruption vulnerability in WatchGuard Fireware OS that can trigger a DoS in Mobile User VPN with IKEv2 and Branch Office VPN using IKEv2 when configured with a dynamic gateway peer. Affected software ranges are Fireware OS 12.6.1–12.11.4 and 2025.1–2025.1.2. The ...

CVE-2025-12994

Medtronic CareLink Network allows an unauthenticated remote attacker to initiate a request for security questions to an API endpoint that could be used to determine a valid user account. This issue affects CareLink Network: before December 4, 2025...

CVE-2025-34319

TOTOLINK N300RT wireless router firmware versions prior to V3.4.0-B20250430 discovered in V2.1.8-B20201030.1539 contain an OS command injection vulnerability in the Boa formWsc handling functionality. An unauthenticated attacker can send specially crafted requests to trigger command execution via...

CVE-2025-13513

CVE-2025-13513 refers to the WordPress plugin Clik stats, where versions up to and including 0.8 are vulnerable to Reflected Cross-Site Scripting via the $_SERVER['PHP_SELF'] parameter due to insufficient input sanitization and output escaping. The vulnerability can allow unauthenticated attacker...

PT-2025-49124

Name of the Vulnerable Software and Affected Versions Medtronic CareLink Network versions prior to December 4, 2025 Description An unauthenticated remote attacker can send a request to an API endpoint to obtain security questions. This could potentially reveal valid user accounts. Recommendations...

PT-2025-49144

Name of the Vulnerable Software and Affected Versions Kalmia CMS version 0.2.0 Description The application exhibits a user enumeration issue in its authentication process. Different error messages are returned depending on whether a user exists or not, or if the password is incorrect. Specificall...

PT-2025-49158

Name of the Vulnerable Software and Affected Versions WatchGuard Fireware OS versions 12.0 through 12.11.4 WatchGuard Fireware OS versions 2025.1 through 2025.1.2 Description A memory corruption issue exists in WatchGuard Fireware OS. An unauthenticated attacker can potentially cause a Denial of...

CVE-2025-12819

Untrusted search path in authquery connection handler in PgBouncer before 1.25.1 allows an unauthenticated attacker to execute arbitrary SQL during authentication via a malicious searchpath parameter in the StartupMessage...

UBUNTU-CVE-2025-12819

Untrusted search path in authquery connection handler in PgBouncer before 1.25.1 allows an unauthenticated attacker to execute arbitrary SQL during authentication via a malicious searchpath parameter in the StartupMessage...

Fanvil x210 安全漏洞

The Fanvil x210 is an IP telephony device from Fanvil. A security vulnerability exists in Fanvil x210 V2 version 2.12.20, which originates from an unauthenticated attacker on the local network who can bypass access to device management features via specially crafted authentication...

CVE-2025-41738

An unauthenticated remote attacker may cause the visualisation server of the CODESYS Control runtime system to access a resource with a pointer of wrong type, potentially leading to a denial-of-service DoS condition...

CVE-2025-13685 Photo Gallery by Ays <= 6.4.8 - Cross-Site Request Forgery to Bulk Actions

The Photo Gallery by Ays plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.4.8. This is due to missing nonce verification on the bulk action functionality in the 'processbulkaction' function. This makes it possible for unauthenticated attacke...

PT-2025-48649

The Photo Gallery by Ays plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.4.8. This is due to missing nonce verification on the bulk action functionality in the 'process bulk action' function. This makes it possible for unauthenticated...

TCMAN GIM 信息泄露漏洞

TCMAN GIM is a management system from the Spanish company TCMAN. An information disclosure vulnerability exists in TCMAN GIM version v11 20250304, which originates from an unauthenticated attacker being able to determine if a user exists via the pda:username parameter...

CVE-2025-41738

An unauthenticated remote attacker may cause the visualisation server of the CODESYS Control runtime system to access a resource with a pointer of wrong type, potentially leading to a denial-of-service DoS condition...